On Fri, Aug 20, 2010 at 10:12 AM, Tyler Ross <[email protected]> wrote: > Good morning group, > > I have been working on a rule that takes failed windows logon attempts and > alerts if the failed logon involves a domain administrative account of some > form. We use various naming conventions for administrative accounts. One > example is sa.* > > Currently I'm using <match>sa.</match> to locate the admin account failure. > However, this also generates an alert for a regular user account such as > lisa.*... I have tried using regular expressions in the form of: > > <match>^sa.</match> > <match>^sa.\.</match> > <match>^sa.\.*</match> > <match>^sa.\.+</match> > <regex>^sa.</regex> > <regex>^sa.\.</regex> > <regex>^sa.\.*</regex> > > and so on. I haven't had any luck with getting any alerts to fire with any > of these statements. Would someone in this group have any ideas? Thanks! > > > > Tyler Ross >
<match> uses the sregex syntax. http://www.ossec.net/doc/syntax/regex.html should explain it a bit. If the alert has a <user> field, you should be able to use the sregex there also. Something like the following should work: <rule id="blah" level="10"> <user>^sa.</user> <match>stuff</match> <description>Some description> </rule>
